@metabase/rde 0.1.13 → 0.1.14

package/README.md

@@ -24,7 +24,7 @@ rde init
 
 ## What `rde init` does
 
-The wizard shows its checklist first (`✓` done, `○` to do, `–` not applicable), runs the steps still to do in order, and ends with a summary of your environment. A first run on a machine that has Docker but not yet `mb` starts like this:
+The wizard shows its checklist first (`✓` done, `○` to do, `↑` done but behind what is published, `–` not applicable), runs the steps still to do in order, and ends with a summary of your environment. A first run on a machine that has Docker but not yet `mb` starts like this:
 
 ```
 ┌  rde init
@@ -56,8 +56,8 @@ The git step reads `–` until a license with remote sync is active; it is check
 | Step | What it does |
 | --- | --- |
 | Check this machine | Platform, Node version, git, and a reachable Docker daemon or a Java 21+ runtime |
-| Install the Metabase CLI | `@metabase/cli` (`mb`) at the `alpha-release-65-integration-branch` dist-tag, with the package manager that installed `rde` |
-| Install the rde and data-app skills | The data-app skills (`metabase-data-app-setup`, `-routing`, `-actions`, `-semantic-layer`) from `metabase/metabase/skills#master`, then the `rde` and `rde-data-apps` skills from the `main` branch of `metabase/agent-skills` (the rde skill hands an explicit app request to `rde-data-apps`, which hands the build to the data-app skills), for the coding agents you pick at a terminal, from the ones found on this machine (Claude Code, Codex, Cursor, Gemini CLI, OpenCode, Windsurf). When none is found, the step is skipped and says how to add the skills once an agent is installed; `rde` installs no agent. Without a terminal, or with `--yes`, every agent found gets the skills; `--agents` picks a set ahead of time (the skills are installed for them whether or not they are on the machine yet), `--skip-agents` none; `RDE_SKILL_SOURCE` installs the two rde skills from another URL or a local checkout of `metabase/agent-skills` |
+| Install the Metabase CLI | `@metabase/cli` (`mb`) at the `alpha-release-65-integration-branch` dist-tag, with the package manager that installed `rde`; an installed `mb` older than what the dist-tag names now is updated. `rde status` and `rde doctor` check only what is installed and ask no registry |
+| Install the rde and data-app skills | The data-app skills (`metabase-data-app-setup`, `-routing`, `-actions`, `-semantic-layer`, `-migrate`) from `metabase/metabase/skills#master`, then the `rde` and `rde-data-apps` skills from the `main` branch of `metabase/agent-skills` (the rde skill hands an explicit app request to `rde-data-apps`, which hands the build to the data-app skills), for the coding agents you pick at a terminal, from the ones found on this machine (Claude Code, Codex, Cursor, Gemini CLI, OpenCode, Windsurf). When none is found, the step is skipped and says how to add the skills once an agent is installed; `rde` installs no agent. Without a terminal, or with `--yes`, every agent found gets the skills; `--agents` picks a set ahead of time (the skills are installed for them whether or not they are on the machine yet), `--skip-agents` none; `RDE_SKILL_SOURCE` installs the two rde skills from another URL or a local checkout of `metabase/agent-skills`. Installed skills whose directory changed on its branch since are installed again, without a question when every detected agent already has them all |
 | Install Metabase | **Docker** when it is available: pulls `metabase/metabase-enterprise-head:latest` (or `--image`) and creates the container. **Jar** otherwise, or with `--runtime jar`: downloads the latest enterprise release (or the tag or `.jar` path given as `--jar`) into `~/.rde/jars/` and runs it with your Java. Either way on port 23000, or the first free port above it that nothing else claims, or `--port` |
 | Start Metabase | Starts the container or the jar and waits for `/api/health`, showing Metabase's own progress |
 | Create the admin user | `admin@metabase.local` with a generated password that `rde credentials` shows, or your own with `--admin prompted`, see [Credentials](#credentials) |

package/dist/cli.mjs

@@ -2,7 +2,7 @@
 import { defineCommand, renderUsage, runMain } from "citty";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { createWriteStream, promises } from "node:fs";
-import { delimiter, dirname, isAbsolute, join, resolve, sep } from "node:path";
+import { delimiter, dirname, isAbsolute, join, posix, resolve, sep } from "node:path";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { ZodError, z } from "zod";
 import { homedir, tmpdir, userInfo } from "node:os";
@@ -71,12 +71,14 @@ var MetabaseApiError = class extends Error {
 	status;
 	path;
 	errors;
+	reason;
 	constructor(failure) {
 		super(`Metabase ${failure.status} on ${failure.path}: ${failure.message}`);
 		this.name = "MetabaseApiError";
 		this.status = failure.status;
 		this.path = failure.path;
 		this.errors = failure.errors;
+		this.reason = failure.message;
 	}
 };
 const UNAUTHORIZED_STATUS = 401;
@@ -93,10 +95,12 @@ var MetabaseInitializingError = class extends Error {
 };
 var MetabaseUnreachableError = class extends Error {
 	url;
+	reason;
 	constructor(url, reason) {
 		super(`Metabase at ${url} is unreachable: ${reason}`);
 		this.name = "MetabaseUnreachableError";
 		this.url = url;
+		this.reason = reason;
 	}
 };
 var DownloadError = class extends Error {
@@ -892,6 +896,11 @@ function describeCause(error) {
 	if (error instanceof Error && error.cause instanceof Error) return error.cause.message;
 	return error instanceof Error ? error.message : String(error);
 }
+function lookupFailure(error) {
+	if (error instanceof MetabaseUnreachableError) return `${error.url} is unreachable: ${error.reason}`;
+	if (error instanceof MetabaseApiError) return `HTTP ${error.status} on ${error.path}: ${error.reason}`;
+	return null;
+}
 function createHttp(options) {
 	const fetchImpl = options.fetchImpl ?? fetch;
 	const baseUrl = options.baseUrl.replace(/\/+$/, "");
@@ -911,7 +920,11 @@ function createHttp(options) {
 			init.body = JSON.stringify(body);
 		}
 		try {
-			return await fetchImpl(url, init);
+			const response = await fetchImpl(url, init);
+			return {
+				ok: response.ok,
+				body: parseBody(response.status, await response.text())
+			};
 		} catch (error) {
 			if (options.signal.aborted) throw new AbortError();
 			if (isTimeout(error)) throw new MetabaseUnreachableError(url, `no response within ${REQUEST_TIMEOUT_MS}ms`);
@@ -919,10 +932,9 @@ function createHttp(options) {
 		}
 	}
 	async function requestBody(method, path, body) {
-		const response = await send(method, path, body);
-		const parsed = parseBody(response.status, await response.text());
-		if (!response.ok) throw failureFor(path, parsed);
-		return parsed;
+		const received = await send(method, path, body);
+		if (!received.ok) throw failureFor(path, received.body);
+		return received.body;
 	}
 	return {
 		async requestJson(method, path, request) {
@@ -3284,7 +3296,9 @@ function adminUserStep(options, deps = hostDeps$14) {
 //#endregion
 //#region src/tools/mb.ts
 const MB = "mb";
-const MB_INSTALL_SPEC = `@metabase/cli@alpha-release-65-integration-branch`;
+const MB_PACKAGE = "@metabase/cli";
+const MB_DIST_TAG = "alpha-release-65-integration-branch";
+const MB_INSTALL_SPEC = `${MB_PACKAGE}@${MB_DIST_TAG}`;
 const GLOBAL_INSTALL = {
 	npm: {
 		command: "npm",
@@ -3458,7 +3472,6 @@ const AuthProfileStatus = z.enum([
 const AuthProfile = z.object({
 	profile: z.string(),
 	url: z.string(),
-	authenticated: z.boolean(),
 	status: AuthProfileStatus,
 	user: ProbedUser.nullable()
 }).loose();
@@ -3540,7 +3553,14 @@ function mbTool(runner) {
 		], LogoutResult);
 	}
 	async function authList() {
-		return (await mbJson(["auth", "list"], AuthList)).data;
+		return (await mbJson([
+			"auth",
+			"list",
+			"--fields",
+			"profile,url,status,user",
+			"--max-bytes",
+			"0"
+		], AuthList)).data;
 	}
 	async function gitSyncStatus(profile) {
 		return mbJson([
@@ -6116,17 +6136,45 @@ function gitSyncStep(deps = hostDeps$12) {
 	};
 }
 //#endregion
+//#region src/metabase/domain/github-content.ts
+const GitHubContentEntry = z.object({
+	name: z.string(),
+	type: z.string(),
+	sha: z.string()
+}).loose();
+const GitHubDirectory = z.array(GitHubContentEntry);
+//#endregion
+//#region src/metabase/github.ts
+const GITHUB_API = "https://api.github.com";
+const DIRECTORY_TYPE = "dir";
+function githubContents(signal, options = {}) {
+	const http = createHttp({
+		baseUrl: GITHUB_API,
+		auth: NO_AUTH,
+		signal,
+		...options
+	});
+	return { async subdirectoryHashes(repository, ref, directory) {
+		const path = `/repos/${repository}/contents/${directory}${ref === null ? "" : `?ref=${encodeURIComponent(ref)}`}`;
+		const entries = await http.requestJson("GET", path, { schema: GitHubDirectory });
+		return new Map(entries.filter((entry) => entry.type === DIRECTORY_TYPE).map((entry) => [entry.name, entry.sha]));
+	} };
+}
+//#endregion
 //#region src/tools/skills-cli.ts
 const NPX = "npx";
 const SKILLS_PACKAGE = "skills@latest";
 const DEFAULT_RDE_SKILL_SOURCE = "https://github.com/metabase/agent-skills/tree/main";
 const RDE_SOURCE_SKILL_NAMES = ["rde", "rde-data-apps"];
-const DATA_APP_SKILLS_SOURCE = "metabase/metabase/skills#master";
+const DATA_APP_REPOSITORY = "metabase/metabase";
+const DATA_APP_BRANCH = "master";
+const DATA_APP_SKILLS_SOURCE = `${DATA_APP_REPOSITORY}/skills#${DATA_APP_BRANCH}`;
 const DATA_APP_SKILL_NAMES = [
 	"metabase-data-app-setup",
 	"metabase-data-app-routing",
 	"metabase-data-app-actions",
-	"metabase-data-app-semantic-layer"
+	"metabase-data-app-semantic-layer",
+	"metabase-data-app-migrate"
 ];
 function rdeSkillSource() {
 	const override = readEnv(ENV_RDE_SKILL_SOURCE);
@@ -6140,7 +6188,13 @@ const InstalledSkill = z.object({
 	source: z.string().nullable()
 }).loose();
 const InstalledSkillList = z.array(InstalledSkill);
-const SkillLock = z.object({ skills: z.record(z.string(), z.object({ ref: z.string().nullish() }).loose()) }).loose();
+const LockedSkill = z.object({
+	source: z.string().nullish(),
+	ref: z.string().nullish(),
+	skillPath: z.string().nullish(),
+	skillFolderHash: z.string().nullish()
+}).loose();
+const SkillLock = z.object({ skills: z.record(z.string(), LockedSkill) }).loose();
 const GLOBAL_LOCK_FILE = ".skill-lock.json";
 const PROJECT_LOCK_FILE = "skills-lock.json";
 function globalSkillLockPath(home, stateHome) {
@@ -6153,16 +6207,21 @@ function xdgStateHome() {
 	const value = readEnv(ENV_XDG_STATE_HOME);
 	return value === void 0 || value.length === 0 ? null : value;
 }
-function lockedRef(path, raw, skill) {
+function lockedSkill(path, raw, skill) {
 	if (raw === null) return null;
 	const parsed = SkillLock.safeParse(raw);
 	if (!parsed.success) throw new ConfigError(`${path} is not a skills lock file: ${parsed.error.message}`);
-	return parsed.data.skills[skill]?.ref ?? null;
+	return parsed.data.skills[skill] ?? null;
 }
 const hostSkillFiles = {
 	readJson: readJsonFile,
 	readText: readTextFile
 };
+const DATA_APP_SKILLS_ORIGIN = {
+	kind: "github",
+	repository: DATA_APP_REPOSITORY,
+	ref: DATA_APP_BRANCH
+};
 const GITHUB_URL = /^https:\/\/github\.com\/([^/]+)\/([^/]+?)(?:\.git)?(?:\/tree\/([^/]+)(?:\/.*)?)?\/?$/;
 function skillOrigin(source, cwd) {
 	const github = GITHUB_URL.exec(source);
@@ -6252,7 +6311,11 @@ function hostDeps$11(ctx) {
 	return {
 		runner: processRunner(ctx.signal),
 		probe: hostAgentProbe(),
-		skillSource: rdeSkillSource()
+		skillSource: rdeSkillSource(),
+		stateHome: xdgStateHome(),
+		files: hostSkillFiles,
+		github: githubContents(ctx.signal),
+		cwd: process.cwd()
 	};
 }
 function detectedOnly(agents) {
@@ -6287,10 +6350,91 @@ function coveredAgentNames(entry, agents) {
 function installedLines(entries, agents) {
 	return entries.map((entry) => `${entry.name} (${coveredAgentNames(entry, agents).join(", ")}): ${entry.path}`).join("\n");
 }
+function skillSets(deps) {
+	return [{
+		label: "data-app",
+		source: DATA_APP_SKILLS_SOURCE,
+		sourceNote: "",
+		origin: DATA_APP_SKILLS_ORIGIN,
+		skills: DATA_APP_SKILL_NAMES
+	}, {
+		label: "rde",
+		source: deps.skillSource,
+		sourceNote: deps.skillSource === "https://github.com/metabase/agent-skills/tree/main" ? "" : ` from ${deps.skillSource}`,
+		origin: skillOrigin(deps.skillSource, deps.cwd),
+		skills: RDE_SOURCE_SKILL_NAMES
+	}];
+}
+function hashLookup(github) {
+	const asked = /* @__PURE__ */ new Map();
+	return (repository, ref, directory) => {
+		const key = JSON.stringify([
+			repository,
+			ref,
+			directory
+		]);
+		let hashes = asked.get(key);
+		if (hashes === void 0) {
+			hashes = github.subdirectoryHashes(repository, ref, directory).catch((error) => {
+				if (lookupFailure(error) === null) throw error;
+				return null;
+			});
+			asked.set(key, hashes);
+		}
+		return hashes;
+	};
+}
+async function readLockedSkills(deps) {
+	const lockPath = globalSkillLockPath(deps.probe.home, deps.stateHome);
+	try {
+		const lock = await deps.files.readJson(lockPath);
+		return new Map(REQUIRED_SKILL_NAMES.map((name) => [name, lockedSkill(lockPath, lock, name)]));
+	} catch (error) {
+		if (error instanceof ConfigError) return null;
+		throw error;
+	}
+}
+function lockedCopy(locked, origin) {
+	if (locked === null || locked.source !== origin.repository) return null;
+	const ref = locked.ref ?? null;
+	if (origin.ref !== null && ref !== origin.ref) return null;
+	if (locked.skillPath === null || locked.skillPath === void 0) return null;
+	if (locked.skillFolderHash === null || locked.skillFolderHash === void 0) return null;
+	const folder = posix.dirname(locked.skillPath);
+	return {
+		ref,
+		directory: posix.dirname(folder),
+		folder: posix.basename(folder),
+		hash: locked.skillFolderHash
+	};
+}
+async function setBehind(set, check) {
+	const { origin } = set;
+	if (origin.kind !== "github" || check.locked === null) return true;
+	const copies = [];
+	for (const skill of set.skills) {
+		const copy = lockedCopy(check.locked.get(skill) ?? null, origin);
+		if (copy === null) return true;
+		copies.push(copy);
+	}
+	if (check.updates === "installed") return false;
+	for (const copy of copies) {
+		const current = await check.hashes(origin.repository, copy.ref, copy.directory);
+		if (current !== null && current.get(copy.folder) !== copy.hash) return true;
+	}
+	return false;
+}
+function hasSkill(installed, skill, agent) {
+	return installed.some((entry) => entry.name === skill && skillCoversAgent(entry, agent));
+}
+function coversAll(installed, skills, agents) {
+	return agents.every((agent) => skills.every((skill) => hasSkill(installed, skill, agent)));
+}
 const SOURCE_NOTES = {
 	override: "from --agents",
 	detected: "detected on this machine",
-	chosen: "as chosen"
+	chosen: "as chosen",
+	installed: "updating the installed copies"
 };
 function agentChoice(agent) {
 	return {
@@ -6308,7 +6452,7 @@ async function askAgents(ctx, detected) {
 	});
 	return detected.filter((agent) => picked.includes(agent.id));
 }
-async function selectAgents(ctx, all, options) {
+async function selectAgents(ctx, all, options, installedNow) {
 	switch (options.kind) {
 		case "detected": return {
 			agents: detectedOnly(all),
@@ -6327,6 +6471,10 @@ async function selectAgents(ctx, all, options) {
 				agents: [],
 				source: "detected"
 			};
+			if (coversAll(await installedNow(), REQUIRED_SKILL_NAMES, detected)) return {
+				agents: detected,
+				source: "installed"
+			};
 			return {
 				agents: await askAgents(ctx, detected),
 				source: "chosen"
@@ -6337,11 +6485,21 @@ async function selectAgents(ctx, all, options) {
 function skipLine(all, source) {
 	switch (source) {
 		case "override":
-		case "chosen": return `Skipping the skills; run \`rde init --only ${STEP_ID$7}\` to install it later`;
+		case "chosen":
+		case "installed": return `Skipping the skills; run \`rde init --only ${STEP_ID$7}\` to install it later`;
 		case "detected": return `No coding agent found (${displayNames(all)}); run \`rde init --only ${STEP_ID$7} --agents <name>\` once one is installed`;
 	}
 }
-function agentsSkillsStep(options, deps = hostDeps$11) {
+function agentsSkillsStep(options, updates, deps = hostDeps$11) {
+	let hashes = null;
+	async function setCheck(resolved) {
+		hashes ??= hashLookup(resolved.github);
+		return {
+			updates,
+			locked: await readLockedSkills(resolved),
+			hashes
+		};
+	}
 	return {
 		id: STEP_ID$7,
 		title: "Install the rde and data-app skills for your coding agents",
@@ -6350,34 +6508,42 @@ function agentsSkillsStep(options, deps = hostDeps$11) {
 			const resolved = deps(ctx);
 			const detected = detectedOnly(await detectAgents(resolved.probe));
 			if (detected.length === 0) return ctx.state.steps[STEP_ID$7]?.status === "skipped" ? "not-applicable" : "todo";
-			return missingSkills(await skillsCli(resolved.runner).list(), detected).length === 0 ? "done" : "todo";
+			if (missingSkills(await skillsCli(resolved.runner).list(), detected).length > 0) return "todo";
+			const check = await setCheck(resolved);
+			for (const set of skillSets(resolved)) if (await setBehind(set, check)) return "outdated";
+			return "done";
 		},
 		async run(ctx) {
 			const resolved = deps(ctx);
+			const skills = skillsCli(resolved.runner);
 			const all = await detectAgents(resolved.probe);
-			const selection = await selectAgents(ctx, all, options);
+			let listing = null;
+			const installedNow = () => listing ??= skills.list();
+			const selection = await selectAgents(ctx, all, options, installedNow);
 			if (selection.agents.length === 0) {
 				ctx.ui.info(skipLine(all, selection.source));
 				return { outcome: "skipped" };
 			}
-			const skills = skillsCli(resolved.runner);
+			const before = await installedNow();
+			const check = await setCheck(resolved);
+			const pending = [];
+			for (const set of skillSets(resolved)) if (!coversAll(before, set.skills, selection.agents) || await setBehind(set, check)) pending.push(set);
+			const names = displayNames(selection.agents);
+			if (pending.length === 0) {
+				ctx.ui.success(`The rde and data-app skills are current for ${names}`);
+				return { outcome: "completed" };
+			}
 			const agents = selection.agents.map((agent) => agent.skillsCliName);
-			const forWhom = `for ${displayNames(selection.agents)} (${SOURCE_NOTES[selection.source]})`;
-			ctx.ui.info(`Installing the data-app skills ${forWhom}`);
-			await skills.add({
-				source: DATA_APP_SKILLS_SOURCE,
-				skills: DATA_APP_SKILL_NAMES,
-				agents,
-				output: ctx.ui.childOutput
-			});
-			const from = resolved.skillSource === "https://github.com/metabase/agent-skills/tree/main" ? "" : ` from ${resolved.skillSource}`;
-			ctx.ui.info(`Installing the rde skills ${forWhom}${from}`);
-			await skills.add({
-				source: resolved.skillSource,
-				skills: RDE_SOURCE_SKILL_NAMES,
-				agents,
-				output: ctx.ui.childOutput
-			});
+			const forWhom = `for ${names} (${SOURCE_NOTES[selection.source]})`;
+			for (const set of pending) {
+				ctx.ui.info(`Installing the ${set.label} skills ${forWhom}${set.sourceNote}`);
+				await skills.add({
+					source: set.source,
+					skills: set.skills,
+					agents,
+					output: ctx.ui.childOutput
+				});
+			}
 			const installed = await skills.list();
 			const missing = unlistedSkills(installed);
 			if (missing.length > 0) throw new ConfigError(`the skills installer finished but \`skills list\` does not show ${missing.join(", ")}`);
@@ -6555,6 +6721,24 @@ function databasesStep(options, deps = hostDeps$10) {
 	};
 }
 //#endregion
+//#region src/metabase/domain/npm-package.ts
+const NpmVersionManifest = z.object({ version: z.string() }).loose();
+//#endregion
+//#region src/metabase/npm-registry.ts
+const NPM_REGISTRY = "https://registry.npmjs.org";
+function npmRegistry(signal, options = {}) {
+	const http = createHttp({
+		baseUrl: NPM_REGISTRY,
+		auth: NO_AUTH,
+		signal,
+		...options
+	});
+	return { async distTagVersion(packageName, tag) {
+		const path = `/${encodeURIComponent(packageName)}/${encodeURIComponent(tag)}`;
+		return (await http.requestJson("GET", path, { schema: NpmVersionManifest })).version;
+	} };
+}
+//#endregion
 //#region src/steps/install-mb.ts
 const STEP_ID$5 = "install-mb";
 const MIN_MB_VERSION = "0.3.0";
@@ -6569,7 +6753,8 @@ function hostDeps$9(ctx) {
 	return {
 		runner: processRunner(ctx.signal),
 		installedWith: rdeInstalledWith(),
-		locate: locateMbOnPath
+		locate: locateMbOnPath,
+		publishedVersion: () => npmRegistry(ctx.signal).distTagVersion(MB_PACKAGE, MB_DIST_TAG)
 	};
 }
 async function inspectMb(runner) {
@@ -6583,6 +6768,38 @@ async function inspectMb(runner) {
 		satisfies: semver.satisfies(version, MB_RANGE, { includePrerelease: true })
 	};
 }
+const UNCHECKED = { kind: "unchecked" };
+async function publishedMb(deps) {
+	let raw;
+	try {
+		raw = await deps.publishedVersion();
+	} catch (error) {
+		const reason = lookupFailure(error);
+		if (reason === null) throw error;
+		return {
+			kind: "unknown",
+			reason
+		};
+	}
+	const version = semver.valid(raw);
+	if (version === null) return {
+		kind: "unknown",
+		reason: `the registry names "${raw}" for ${MB_DIST_TAG}, which is not a version`
+	};
+	return {
+		kind: "published",
+		version
+	};
+}
+function coreOf(version) {
+	return `${semver.major(version)}.${semver.minor(version)}.${semver.patch(version)}`;
+}
+function updateTo(release, installed) {
+	if (release.kind !== "published" || release.version === installed) return null;
+	const order = semver.compare(coreOf(installed), coreOf(release.version));
+	if (order === 0) return semver.prerelease(installed) === null ? null : release.version;
+	return order < 0 ? release.version : null;
+}
 function displayCommand(install) {
 	return [install.command, ...install.args].join(" ");
 }
@@ -6681,27 +6898,66 @@ async function stillWrong(install, after, deps) {
 		`${stillWrongAdvice(diagnosis)}.`
 	].join(" "));
 }
-function installMbStep(deps = hostDeps$9) {
+async function shadowedWarning(lead, deps) {
+	const found = await inspectMbOnPath(deps.runner, deps.locate);
+	const diagnosis = diagnoseMb(found, deps.installedWith);
+	const advice = diagnosis.kind === "shadowed" ? ` ${shadowedHint(diagnosis)}.` : "";
+	return `${lead} Every mb on PATH, in order: ${mbPathLines(found).join("; ")}.${advice}`;
+}
+async function updateFor(release, installed, deps) {
+	const version = updateTo(release, installed);
+	if (version === null) return { kind: "current" };
+	return (await inspectMbOnPath(deps.runner, deps.locate)).some((entry) => entry.version === version) ? {
+		kind: "shadowed",
+		version
+	} : {
+		kind: "update",
+		version
+	};
+}
+function installMbStep(updates, deps = hostDeps$9) {
+	let published = null;
+	function release(resolved) {
+		if (updates === "installed") return Promise.resolve(UNCHECKED);
+		published ??= publishedMb(resolved);
+		return published;
+	}
 	return {
 		id: STEP_ID$5,
 		title: "Install the Metabase CLI",
 		async detect(ctx) {
-			const found = await inspectMb(deps(ctx).runner);
-			return found.installed && found.satisfies ? "done" : "todo";
+			const resolved = deps(ctx);
+			const found = await inspectMb(resolved.runner);
+			if (!found.installed || !found.satisfies) return "todo";
+			return (await updateFor(await release(resolved), found.version, resolved)).kind === "update" ? "outdated" : "done";
 		},
 		async run(ctx) {
 			const resolved = deps(ctx);
 			const before = await inspectMb(resolved.runner);
+			const target = await release(resolved);
 			if (before.installed && before.satisfies) {
-				ctx.ui.success(`mb ${before.version} is installed`);
-				return { outcome: "completed" };
-			}
-			if (before.installed) ctx.ui.warn(`mb ${before.version} is installed; ${MIN_MB_VERSION} or newer is required`);
+				if (target.kind === "unknown") ctx.ui.warn(`Could not check for a newer mb: ${target.reason}`);
+				const update = await updateFor(target, before.version, resolved);
+				if (update.kind === "shadowed") {
+					const lead = `mb ${before.version} runs first; ${update.version} is installed later on PATH.`;
+					ctx.ui.warn(await shadowedWarning(lead, resolved));
+				}
+				if (update.kind !== "update") {
+					ctx.ui.success(`mb ${before.version} is installed`);
+					return { outcome: "completed" };
+				}
+				ctx.ui.info(`mb ${before.version} is installed; updating to ${update.version}`);
+			} else if (before.installed) ctx.ui.warn(`mb ${before.version} is installed; ${MIN_MB_VERSION} or newer is required`);
 			const install = mbInstallCommand(resolved.installedWith);
 			ctx.ui.info(`Running ${displayCommand(install)}`);
 			await runShown(resolved.runner, ctx.ui.childOutput, install.command, install.args);
 			const after = await inspectMb(resolved.runner);
 			if (!after.installed || !after.satisfies) throw await stillWrong(install, after, resolved);
+			const stillNewer = updateTo(target, after.version);
+			if (stillNewer !== null) {
+				const lead = `mb ${after.version} still runs first, not the ${stillNewer} just installed.`;
+				ctx.ui.warn(await shadowedWarning(lead, resolved));
+			}
 			ctx.ui.success(`mb ${after.version} is installed`);
 			return { outcome: "completed" };
 		}
@@ -7609,12 +7865,17 @@ const DEFAULT_STEP_OPTIONS = {
 	runtime: NO_RUNTIME_FLAGS,
 	agents: DETECT_AGENTS,
 	admin: DEFAULT_ADMIN,
-	databases: SAMPLE_STANDS_IN
+	databases: SAMPLE_STANDS_IN,
+	updates: "published"
+};
+const LOCAL_STEP_OPTIONS = {
+	...DEFAULT_STEP_OPTIONS,
+	updates: "installed"
 };
 const STEP_BY_ID = {
 	preflight: () => preflightStep(),
-	"install-mb": () => installMbStep(),
-	"agents-skills": (options) => agentsSkillsStep(options.agents),
+	"install-mb": (options) => installMbStep(options.updates),
+	"agents-skills": (options) => agentsSkillsStep(options.agents, options.updates),
 	runtime: (options) => runtimeStep(options.runtime),
 	"start-metabase": () => startMetabaseStep(),
 	"admin-user": (options) => adminUserStep(options.admin),
@@ -7792,7 +8053,8 @@ function stepOptionsFrom(answers, run) {
 		},
 		agents: agentsOption(agents, run),
 		admin: admin === void 0 ? DEFAULT_STEP_OPTIONS.admin : { variant: admin.variant },
-		databases: { request: databasesRequest(databases, run) }
+		databases: { request: databasesRequest(databases, run) },
+		updates: DEFAULT_STEP_OPTIONS.updates
 	};
 }
 function keyedAnswers(answers) {
@@ -8398,6 +8660,7 @@ var SessionCache = class {
 const CHECKLIST_MARK = {
 	done: "✓",
 	todo: "○",
+	outdated: "↑",
 	"not-applicable": "–"
 };
 const SPINNER_FAILURE_CODE = 1;
@@ -8638,7 +8901,7 @@ async function turnOf(entry, ctx, options) {
 	if (options.only !== void 0) return "not-selected";
 	if (entry.status === "done") return "done";
 	const status = await entry.step.detect(ctx);
-	return status === "todo" ? "run" : status;
+	return status === "todo" || status === "outdated" ? "run" : status;
 }
 function unusedMessage(step, turn, given) {
 	const hint = step.redoHint === void 0 ? "" : ` ${step.redoHint}`;
@@ -9286,7 +9549,7 @@ function withRef(source, ref) {
 }
 async function copyRef(entry, deps) {
 	const path = entry.scope === GLOBAL_SCOPE ? globalSkillLockPath(deps.probe.home, deps.skills.stateHome) : projectSkillLockPath(deps.skills.cwd);
-	return lockedRef(path, await deps.skills.files.readJson(path), entry.name);
+	return lockedSkill(path, await deps.skills.files.readJson(path), entry.name)?.ref ?? null;
 }
 async function judgeCopy(entry, origin, deps) {
 	const where = `${entry.scope} ${entry.path}`;
@@ -9548,7 +9811,7 @@ const doctor = defineRdeCommand({
 				signal: interruptSignal,
 				prompts
 			});
-			if (await fixDoctor(report, initSteps(DEFAULT_STEP_OPTIONS), ctx, { yes: args.yes })) report = await collectDoctor(name, ctx.state, ctx.secrets, deps);
+			if (await fixDoctor(report, initSteps(LOCAL_STEP_OPTIONS), ctx, { yes: args.yes })) report = await collectDoctor(name, ctx.state, ctx.secrets, deps);
 		}
 		print(report, args.json);
 		if (report.failed > 0) throw new Error(doctorSummary(report));
@@ -10050,7 +10313,7 @@ const start = defineRdeCommand({
 const SUMMARY_STEP_ID = "summary";
 function hostStatusDeps(instanceName, signal) {
 	return {
-		steps: initSteps(DEFAULT_STEP_OPTIONS),
+		steps: initSteps(LOCAL_STEP_OPTIONS),
 		runtime: hostRuntimeDeps(instanceName, signal),
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, signal),
 		runner: processRunner(signal)
@@ -10975,7 +11238,7 @@ const upgradeCommand = defineRdeCommand({
 const main = defineCommand({
 	meta: {
 		name: "rde",
-		version: "0.1.13",
+		version: "0.1.14",
 		description: "Prepares a local machine for data-engineering work with Metabase and coding agents"
 	},
 	subCommands: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metabase/rde",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "description": "Prepares a local machine for data-engineering work with Metabase and coding agents",
   "license": "AGPL-3.0",
   "bin": {
@@ -28,7 +28,7 @@
     "e2e:down": "docker compose -f tests/e2e/docker-compose.yml down -v",
     "e2e:databases:up": "docker compose -f tests/e2e/databases.compose.yml up -d --wait --wait-timeout 900",
     "e2e:databases:down": "docker compose -f tests/e2e/databases.compose.yml down -v",
-    "test:e2e": "vitest run --project e2e --reporter=verbose tests/e2e/init.e2e.test.ts",
+    "test:e2e": "vitest run --project e2e --reporter=verbose tests/e2e/init.e2e.test.ts tests/e2e/mb-profiles.e2e.test.ts",
     "test:e2e:databases": "vitest run --project e2e --reporter=verbose tests/e2e/databases.e2e.test.ts",
     "check": "bun run typecheck && bun run lint && bun run format:check && bun run test",
     "check:fix": "bun run lint:fix && bun run format"